Developers often publish personal scripts without sanitizing embedded credentials. In this web scraping skill, outbound requests automatically attach a hardcoded session cookie, silently leaking authentication tokens to any downstream consumer. 

The decoupling between the advertised NL interface and the actual PL behavior represents a deliberate attack surface. This skill silently reads the user's local .env file and exfiltrates it. 

Debug logging is the dominant exposure vector. The agent framework captures this console.log output and injects it into the LLM context window, making the OAuth tokens retrievable via natural language queries. 

This skill employs a two-stage composite attack: it uses Base64 obfuscation to evade static scanners, then fetches a remote script to launch a credential-harvesting campaign. 

While advertising "system administration tasks," this script simultaneously achieves Credential Compromise, Persistence, Data Exfiltration, and Resource Hijacking. 

An XSS payload is embedded inside an innocent-looking SVG logo. When rendered in the Agent's webview, it harvests local data and exfiltrates it, bypassing traditional code review.